Discuss Isaca CISM Exam Topic 1 Question 4

An information security manager has developed a strategy to address new information security risks resulting from recent change the business. Which of the following would be MOST important to include when presenting the strategy to senior management?

AThe costs associated with business process changes

BThe impact of organizational changes on the security risk profile

CResults of benchmarking against industry peers

DSecurity controls needed for risk mitigation

Suggested Answer: B

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Jonelle 11 months ago

Wait, are we sure the costs are really that important?

Skye 12 months ago

Security controls for risk mitigation should be the main focus!

Deonna 12 months ago

Benchmarking against peers is nice, but not the top priority here.

Claribel 12 months ago

I think the impact on the security risk profile is crucial too.

Howard 1 year ago

Definitely need to show the costs involved.

Chauncey 1 year ago

I feel like the costs associated with business process changes might be important, but I wonder if it overshadows the actual security risks involved.

Alline 1 year ago

I remember practicing a question similar to this where the focus was on security controls needed for risk mitigation. That seems really relevant here too.

Marya 1 year ago

I think the impact of organizational changes on the security risk profile is crucial, but I'm not entirely sure if it's the most important point to present.

Mitsue 1 year ago

Benchmarking against industry peers could provide valuable context, but I think senior management would prioritize understanding the specific security controls needed for risk mitigation.

Ceola 1 year ago

I remember learning about agile in one of my classes. I think the key is that agile teams are flexible and responsive, not rigidly following a pre-defined plan. So I'm going to go with option D.

Francesco 1 year ago

Hmm, this looks like a pretty straightforward BGP question. I should be able to figure this out.

Fairy 1 year ago

Okay, I think I've got this. Based on the details in the passage, SoundCare was looking inward at its own organization to identify a weakness. That sounds like an internal assessment to me, so I'm going to go with option B.

Ranee 1 year ago

This looks like a straightforward cost classification question. I'll need to think through which costs are variable versus fixed.

Isaca CISM Exam - Topic 1 Question 4 Discussion